Fix crash in JSReceiver::GetCreationContext

It failed on the CHECK when receiver object was JSAsyncFunctionObject.

BUG=chromium:901241

Change-Id: I7ce563758185908728135005cb5ba2878fdea446
Reviewed-on: https://chromium-review.googlesource.com/c/1382822Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58412}

src/objects.cc

@@ -4035,6 +4035,8 @@ Handle<Context> JSReceiver::GetCreationContext() {
   } else if (constructor->IsFunctionTemplateInfo()) {
     // Remote objects don't have a creation context.
     return Handle<Context>::null();
+  } else if (receiver->IsJSGeneratorObject()) {
+    function = JSGeneratorObject::cast(receiver)->function();
   } else {
     // Functions have null as a constructor,
     // but any JSFunction knows its context immediately.